In traditional Ethernet (802.3 10BASE5) and Cheapernet (802.3 10BASE2) a coaxial cable provides the linear bus to which all nodes are connected. Signalling is achieved using a current sink technique with a center conductor used for the signal and a shield used as a ground reference. All devices are connected to the coaxial bus, and therefore all devices will receive the transmission of a single device. Twisted pair Ethernet (802.3 10BASE-T) utilizes standard voice grade telephone cable, employing differential signalling on separate transmit and receive pairs of the cables. 10BASE-T provides only a point-to-point communication capability and requires additional active elements, e.g., a repeater, to provide a point-to-multipoint local area network (LAN) capability. An Ethernet network system typically includes a number of interconnected cable segments. A repeater is used to interconnect two or more cable segments. Each cable segment may be one of a variety of cable types, for example, coaxial or twisted pair. The repeater performs signal amplitude and timing restoration on an incoming bitstream and repeats the bitstream to all of the ports connected to the repeater. By repeating data to all ports, the repeater acts as a logical coaxial cable so that any node connected to the network will see another node's transmission.
Traditionally, repeaters allow wired coaxial Ethernet to extend a network's physical distance limit. For twisted pair Ethernet, if more than two nodes are required to provide connectivity, the IEEE 802.3 10BASE-T Standard mandates the use of a repeater. Although the physical signalling on the coaxial and twisted pair cabling differs, the functionality of the repeater for either is identical as is the frame or packet format used to pass messages through the repeater between the participating nodes on the network.
FIGS. 1 and 2 show the format for an IEEE 802.3 Standard compliant packet and an Ethernet packet, respectively. The packet commences with a preamble sequence which is an alternating (1,0) pattern. The preamble provides a single frequency on the network, in this case 5 Mega Hertz (MHz) at the start of each frame, which allows a receiver to lock to the incoming bitstream. The preamble sequence is then followed by a start of frame indicating that the data portion of the message will follow. Either a start of frame delimiter (802.3) or synch sequence (Ethernet) is used to delineate the start of the data portion of the message. A primary difference as shown is the start of frame delimiter (SFD). For 802.3, the SFD is defined as a byte that has a "1,0, 1,0, 1,0, 1,1" pattern whereas the start frame (synch) of Ethernet is a "1,1" sequence. However, in both cases the preamble plus the start of frame indication is a total of 64 bits long.
Regarding packet size, both 802.3 and Ethernet standards specify that a packet must be in the range of 64-1518 bytes. However, the actual data field in the 802.3 system is permitted to be smaller than the 46 byte value that ensures a minimum packet size. The Media Access Control sub-layer appends pad characters to a Logical Link Control (LLC) data field before sending data over the network to compensate for a smaller data field. The Ethernet standard assumes that the upper layer ensures that the minimum data field is 46 bytes before passing data to a Media Access Control (MAC) sublayer and the existence of these appended characters is unknown to the MAC device.
The 802.3 standard also uses a length field which indicates the number of data bytes that are in the LLC data and pad fields only. The high order byte of the length field is transmitted first with the least significant bit (LSB) of each byte transmitted first. Ethernet, on the other hand, uses a type field in the same two bytes of the frame to identify the message protocol type.
The data field contains the actual packet data that is being transferred and is between 46 to 1500 bytes in length. Since valid Ethernet type fields are always assigned outside of the valid maximum 802.3 packet length size, both 802.3 and Ethernet packets can coexist on the same network.
The LLC function fragments data into block sizes suitable for transmission over the network. Data bytes are transmitted sequentially with the LSB of each byte transmitted first. Following the LLC data/pad fields, the frame check sequence (FCS) is a four-byte field that contains the cyclic redundancy check (CRC) for the entire frame. The CRC is computed by the transmitting station on the destination address, source address, length/type, and data field and is appended as the last four bytes of the frame. The same CRC algorithm is used by the receiving station to compute the CRC value for the frame as it is received. The value computed at the receiver is compared with the value appended by the transmit station to provide an error detection mechanism for corrupted data. The CRC bits within the FCS are transmitted in the order most significant bit to least significant bit.
Two other fields of the frame are the destination address (DA) and the source address (SA) for the frame. Both addresses are 48 bit values transmitted LSB first. A receiving MAC determines if a match exists between the receiver's node address and the address within the DA field. Only a node indicated as matching should attempt to receive the remainder of the packet.
Three types of destination addressing are supported by the 802.3 and Ethernet standards.
1. Individual. The DA field contains an individual and unique address assigned to one node on the network.
2. Multicast. If the first bit of the DA field is set this indicates that the group address is being used. The group of nodes that will be addressed is determined by a higher layer function but in general the intent is to transmit a message between a logically similar subset of nodes on the network.
3. Broadcast. The broadcast is a special form of multicast address where the DA field is set to all is. The address is reserved, and all nodes on the network must be capable of receiving a broadcast message.
The source address field is supplied by the transmitting MAC. The transmitting MAC inserts a sender's node address into the SA field as the frame is transmitted to indicate the node as the originating station of the packet. The receiving MAC is not required to take action based on the SA field.
Network management, analysis and/or diagnostic equipment is typically concerned with the information in a packet that determines statistical information for the network. Statistical information includes what type of packets are on the network, e.g., what type of protocols are being used on the network, the packet sender, the packet receiver, and distribution of the lengths of the packets being transferred on the network to identify how well a network is being utilized. The statistical information typically comprises approximately the first forty bytes of the data packets being sent on the network.
Usually, the MAC used in such network equipment operates in promiscuous mode in order to see every packet and collect the data necessary to compile the statistics for the network. Unfortunately, while in promiscuous mode, the MAC receives all packets on the network, and an intelligent system must sift through the data in each packet in order to extract the statistical information from the packet. The data extraction process requires significant processing time and ability by the intelligent system, especially for large data packets. Large data packets further require greater memory storage space in the intelligent system.
A need exists to determine statistical information on a network using a MAC that reduces processing time and complexity as well as memory storage requirements without compromising the integrity of the data gathered from the network and the data packets transferred on the network. The present invention addresses these needs.